Python bindings for Intel's XED

huku <[email protected]>

About

pyxed is a Python extension that uses Intel's XED library to decode x86 instructions. It is designed to be a wrapper around XED's C API and, as such, it doesn't provide any high level abstractions.

Compiling pyxed

pyxed comes with Makefiles for the most widely used platforms, namely Microsoft Windows, MacOS X and Linux. All Makefiles require that you edit them and set XED_PREFIX appropriately. In order to compile the Python 3 module, you will need to initialize the sub-modules:

$ git submodule update --init --recursive

Linux

There are two methods for compiling pyxed: Using the make file (Python 2 only) or using the Python distools.

Makefile (Python 2)

Compiling on Linux requires GCC to be installed (chances are it is). Just open a terminal, enter pyxed's top-level directory and run make.

Python Distools (Python 2 and 3)

Simply build the module:

$ python3 setup.py build

MacOS X

Compiling on MacOS X requires the XCode command line utilities to be installed. Just open a terminal, enter pyxed's top-level directory and run make.

To test that everything works as expected, use the following command:

$ PYTHONPATH=. python examples/dump_asm.py 41414141

Depending on the XED version, you might get the following error when trying to import pyxed in your project.

Traceback (most recent call last):
  File "<string>", line 1, in <module>
ImportError: dlopen(pyxed.so, 2): Library not loaded: obj/libxed.dylib
  Referenced from: pyxed.so
  Reason: unsafe use of relative rpath obj/libxed.dylib in pyxed.so with restricted binary

This is a problem related to hardcoded rpath values in Intel's libxed.dylib. To fix it, run the following command after substituting /path/to/libxed.dylib with the actual path of libxed.dylib in your filesystem.

$ otool -L pyxed.so | grep libxed.dylib
    obj/libxed.dylib
$ install_name_tool -change obj/libxed.dylib /path/to/libxed.dylib pyxed.so

Microsoft Windows

Compiling on Microsoft Windows requires Visual Studio to be installed. Just open a console, enter pyxed's top-level directory and set PYTHON27_PREFIX in Makefile to the location where Python is installed on your system. Then, run the following commands to build a 32-bit binary:

C:\pyxed> "C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\vcvarsall.bat"
C:\pyxed> nmake /F Makefile.nmake

Or the following to build a 64-bit binary:

C:\pyxed> "C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\vcvarsall.bat" amd64
C:\pyxed> nmake /F Makefile.nmake

In newer versions of Visual Studio you might need to replace the amd64 argument with x86_amd64.

Compiling for use with IDAPython

To use pyxed with IDAPython, make sure you link the first with the appropriate Python version.

For example, on my MacOS X system, IDAPython runs on Python 2.6.x:

Python>sys.version
2.6.7 (r267:88850, Oct 11 2012, 20:15:00)
[GCC 4.2.1 Compatible Apple Clang 4.0 (tags/Apple/clang-418.0.60)]

To make pyxed work correctly I had to replace python2.7-config with python2.6-config in Makefile.

Precompiled binaries

Experimental precompiled binaries for Microsoft Windows can be downloaded from here. The tarball includes both a 32-bit and a 64-bit release of pyxed.

Debian packages are also planned for the near future.

Using pyxed

For information on how to use pyxed, have a look at examples/.

If your compiler throws a warning, if you happen to hit a bug, or if you have any comments or suggestions please let me know.

References

• XED downloads
• XED documentation